Privacy Policy

1. Information We Collect

When you create an account, purchase hosting or domain assets, or engage with our support services, we collect:

• Identity & Contact Particulars: Your full name, business or corporate entity name, email address, telephone/mobile number, and mailing address.
• Statutory Indian Tax Information: Goods and Services Tax Identification Number (GSTIN), Permanent Account Number (PAN), and GST State Code (for legal tax invoice issuance under Indian GST laws).
• Account Credentials: Securely salted and hashed passwords (using industry-standard Bcrypt/Argon2 algorithms) and two-factor authentication (TOTP) seed secrets. We never store plaintext passwords.
• Service & Domain Configurations: Domain names registered or hosted, server hostnames, IP allocations, technical DNS records, and support ticket correspondence.
• Technical Telemetry & Log Data: Internet Protocol (IP) addresses, browser type, operating system, HTTP referrers, request timestamps, and session identifiers.

2. Payment & Financial Information Security

All payment processing is handled exclusively through RBI-licensed payment aggregators (such as Razorpay and Stripe). When you execute a transaction:

• Your payment details are transmitted via 256-bit TLS/SSL encrypted channels directly to the certified payment aggregator.
• The gateway provides us solely with a non-sensitive transaction identifier, status code, payment method type (e.g. UPI, NetBanking, Card), and timestamp to verify receipt.

3. Purpose & Legal Basis for Processing

We process your data exclusively for legitimate operational and legal purposes:

• Service Provisioning: Setting up cPanel accounts, configuring web servers, provisioning DNS zones, and issuing automated SSL certificates.
• Billing & Statutory Compliance: Generating tax-compliant GST invoices, calculating applicable CGST/SGST/IGST, recording payments, and maintaining audited accounts as required by the Indian Companies Act and GST laws.
• Security & Fraud Prevention: Detecting brute-force login attempts, preventing unauthorized server intrusions, and validating account ownership.
• Critical Notifications: Sending transactional renewal notices, invoice receipts, support desk updates, and service interruption notifications.

4. Third-Party Disclosures & Service Providers

We do not sell or monetize your data. We share necessary operational data solely with the following essential entities:

• Domain Registries & WHOIS: Domain registration details are submitted to official central registries (NIXI for .IN, ICANN accredited registrars for gTLDs) in accordance with global domain registration requirements.
• Payment Aggregators: Transaction amounts and customer contact particulars are shared with payment gateways (Razorpay, Stripe) to process requested billing transactions.
• Datacenter & Infrastructure Partners: Data is hosted in Tier-III and Tier-IV carrier-grade facilities (Equinix, STT GDC) adhering to ISO 27001 and SOC2 physical security standards.
• Law Enforcement & Legal Mandates: We may disclose information if required to do so by a valid court order, subpoena, or lawful request by Indian regulatory authorities or law enforcement agencies under the Information Technology Act.

5. Data Retention & Deletion

We retain your account data for as long as your customer account remains active. Upon service termination or cancellation, data is retained for statutory periods mandated by Indian tax and accounting laws (typically 7 years for financial records and GST invoices).

Website content and databases associated with terminated hosting accounts are removed from our active production systems following the expiration of the retention grace period.

6. Cookies & Local Storage

PhynixOne utilizes essential HTTP cookies and browser LocalStorage strictly for functional purposes:

• Session Authentication: Maintaining secure authenticated sessions in the Client Portal and Admin Dashboard.
• User Preferences: Storing your preferred visual theme (Light / Dark mode) and currency display preference (INR ₹ / USD $).
• Security Tokens: CSRF protection tokens to prevent cross-site request forgery attacks.

7. Your Rights under the Digital Personal Data Protection (DPDP) Act

Under the Indian Digital Personal Data Protection Act, 2023, you have the right to:

• Access a summary of your personal data processed by us.
• Request correction, updating, or completion of inaccurate personal data via the Client Portal Profile page.
• Request erasure of personal data that is no longer necessary for the legal purpose for which it was collected.
• Nominate an individual to exercise data rights in the event of incapacity.

8. Grievance Redressal Officer

In compliance with the Information Technology Act, 2000, IT Rules 2011, and the Consumer Protection (E-Commerce) Rules, 2020, the designated Grievance Redressal Officer for PhynixOne is: